Stop Malicious Hacker

Question

Someone keeps posting a large number of vulgar posts to my database. They are usually the same. The only way I can stop them is by breaking the .php page, and then deleting them, and then adding something like the following to the .php post page:

    if (strpos($_POST['password'], 'curse*') === false){
    if (strpos($_POST['username'], 'curse*') === false){
    if (strpos($_POST['password'], 'curse*') === false){
    if (strpos($_POST['username'], 'curse*') === false){
    if (strpos($_POST['password'], 'curse*') === false){
    if (strpos($_POST['username'], 'curse*') === false){
    }}}}}}

Obviously when I do this it stops him from using those words, but he just changes them and hits the database again.

How can I stop this malicious posting?

They are posting reddit usernames now vossbot SyVala GeekYogurt and taking the the titles of their posts and putting them into my database. How is this happening?

you're logging the ip address used to make these requests, right? — castis, Mar 03 '15 at 21:25
This should probably be moved to http://webmasters.stackexchange.com/ — Brent Washburne, Mar 03 '15 at 21:27
I'm voting to close this question as off-topic because it seems to be about network security, rather than a programming problem. Unfortunately, Stack Overflow is focused on the latter. — David Thomas, Mar 03 '15 at 22:06

score 2 · Answer 1 · answered Mar 03 '15 at 21:30

2

Implement a new user approval system that only accepts after you approve.

If you want a new user automated system, then put in a 1 hour or 24 hour delay, with a notification to you.

Does the password really matter and need to be censored if it is only seen by the user and the database admin?

Without more details of the new user system you have set up, it is hard to be more specific. For example, can't answer the "have to break the .php page" aspect.

answered Mar 03 '15 at 21:30

Alan

716
5
15

I just remove a } and it stops them. – Adreamcathcer Adreamcatcher Mar 03 '15 at 21:31
1

Good point on the password. But really it ought to be hashed, so the database admin need not see it either, and then he can't be offended by it. – developerwjk Mar 03 '15 at 21:43

Stop Malicious Hacker

1 Answers1